CVE-2026-112044: dotnet eShop Catalog API Extensions.cs AddApplicationServices improper authentication
A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the function AddApplicationServices of the file src/Catalog.API/Extensions/Extensions.cs of the component Catalog API. The manipulation leads to improper authentication. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of dotnet eShop that include the Catalog API and are based on code up to commit 913acea66708a59595351174cee9b29f37179d29 are potentially affected. The issue is in the Catalog API's AddApplicationServices function in src/Catalog.API/Extensions/Extensions.cs.
Does exploitation require credentials or user interaction?
No. The reported CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What impact could successful exploitation have?
The reported vector assigns low impact to confidentiality, integrity, and availability, indicating an attacker may be able to cause limited effects in each of those areas. The scope is reported as unchanged.
Is a fix available?
The provided information does not identify a fixed version or commit. It states that the project was notified through an issue report but had not responded at the time of the report.